topic Inbound UDP 137 traffic keeps appearing in Network Security

Inbound UDP 137 traffic keeps appearing

leo_zidane — Mon, 11 Mar 2019 12:37:46 GMT

I have a ASA 5510 configured with vpn capability. Somehow the vpn client will keep broadcasting the traffic via UDP port 137. Why is this so?

Thanks

Re: Inbound UDP 137 traffic keeps appearing

Richard Burts — Tue, 29 Apr 2008 11:30:27 GMT

Leonard

Broadcasting on UDP port 137 is a typical Windows networking behavior. Are these VPN clients Windows PCs?

HTH

Rick

Re: Inbound UDP 137 traffic keeps appearing

leo_zidane — Tue, 29 Apr 2008 11:33:04 GMT

Yes they are VPN clients Windows PCs. Why?

Re: Inbound UDP 137 traffic keeps appearing

Richard Burts — Tue, 29 Apr 2008 11:46:38 GMT

Leonard

Because if they are Windows PCs then broadcasting on UDP 137 is a normal behavior. Your question suggested that there was something unexpected or unusual. But Windows PCs broadcasting on UDP 137 is quite normal.

HTH

Rick

Re: Inbound UDP 137 traffic keeps appearing

leo_zidane — Tue, 29 Apr 2008 11:50:44 GMT

However the ASA 5510 keeps sending me alerts on the VPN clients keep broadcasting the traffic indicating them to be critical alerts. Why is this so?

Re: Inbound UDP 137 traffic keeps appearing

Richard Burts — Tue, 29 Apr 2008 14:20:52 GMT

Leonard

Without knowing how your ASA is set up I could not tell you why it is alerting on this traffic.

HTH

Rick

Re: Inbound UDP 137 traffic keeps appearing

leo_zidane — Wed, 30 Apr 2008 11:44:02 GMT

Thanks. I don't remember setting my firewall on this setting. But from your expertise what can the problem be isolated at?

But then my VPN permit client out to the internet after they are authenicated. Cannot be they must keep broadcasting the network with netbios.